mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial institution is migrating its customer…
A financial institution is migrating its customer data to a cloud environment. The cloud provider offers encryption at rest and in transit using AES-256 and TLS 1.2+. The compliance team requires that the organization maintain full control of encryption keys to meet regulatory obligations such as PCI DSS and local banking laws. The data is highly sensitive and includes personally identifiable information (PII). Which solution should the security architect recommend?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption with keys stored on-premises
Client-side encryption with keys stored on-premises ensures the organization retains exclusive control over encryption keys. Relying on cloud provider's encryption with KMS gives key management to the provider, which may not satisfy compliance. Accepting provider encryption without additional controls surrenders control. Tokenization can protect data but removes original format, which may not be acceptable for all uses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement client-side encryption with keys stored on-premises
Why this is correct
Implementing client-side encryption ensures that the financial institution encrypts its customer data *before* it ever leaves their on-premises environment and is transmitted to the cloud provider. This critical step means the cloud provider only ever receives ciphertext, never the sensitive plaintext data. Furthermore, by storing the encryption keys exclusively on-premises, the institution maintains absolute control over the decryption process, preventing any unauthorized access by the cloud provider or external entities, which is paramount for data sovereignty and regulatory compliance.
- ✗
Use tokenization instead of encryption
Why it's wrong here
Tokenization replaces sensitive data elements with non-sensitive substitutes, or tokens, which can be useful for reducing the scope of PCI DSS or other compliance requirements for specific data fields. However, it is not a direct substitute for comprehensive encryption when migrating *all* customer data, as the original sensitive data still needs to be securely stored in a token vault, which itself requires robust encryption and key management. Moreover, tokenization may not preserve the full functionality or referential integrity required for all types of customer data operations in the cloud.
- ✗
Use the cloud provider's default encryption with their key management service
Why it's wrong here
Utilizing the cloud provider's default encryption with their Key Management Service (KMS) means that while the institution might *manage* key policies, the cloud provider ultimately *controls* the underlying cryptographic operations and has potential access to the keys within their secure hardware modules. This shared control model, where the provider can potentially access or be compelled to disclose keys, fundamentally fails to meet the stringent requirement for the financial institution to maintain 'full control' over its encryption keys and the plaintext data. Such an approach introduces a trust dependency on the cloud provider that may not align with strict regulatory mandates for data sovereignty.
- ✗
Accept the provider's encryption without additional controls
Why it's wrong here
Simply accepting the cloud provider's default encryption without implementing additional controls or managing the keys yourself provides the least amount of security and control for sensitive customer data. In this scenario, the cloud provider generates, stores, and manages all encryption keys, meaning they have complete access to decrypt the data at any time. This complete lack of key control by the financial institution directly violates most compliance requirements for sensitive financial data, as it offers no independent assurance against provider access or compromise.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Tokenization
Tokenization is the process of replacing sensitive data with unique identification symbols that retain all the essential information about the data without compromising its security.
Key term
Encryption at rest
Encryption at rest is the practice of securing stored data by converting it into an unreadable format using cryptographic algorithms, so that even if physical or digital access to the storage medium is obtained, the data remains confidential.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.